Update docker image updates to v9.8-1784190466#304
Conversation
Signed-off-by: red-hat-konflux-kflux-prd-rh02 <190377777+red-hat-konflux-kflux-prd-rh02[bot]@users.noreply.github.com>
📝 WalkthroughWalkthroughThe Dockerfile builder stage image changed from Estimated code review effort: 1 (Trivial) | ~2 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 11✅ Passed checks (11 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
✨ Simplify code
Comment |
Risk Score: 0 —
|
| Signal | Detail | Points |
|---|---|---|
| PR size | 2 lines | +0 |
| Sensitive paths | none | +0 |
Computed by hyperfleet-risk-scorer
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@Dockerfile`:
- Line 3: Pin the Dockerfile base images used by the builder stage and runtime
stage to immutable digests instead of mutable tags, including replacing
ubi9/go-toolset:9.8-1784190466 and ubi9-micro:latest with their corresponding
sha256 digests while preserving the existing stage structure.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Central YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: da8f95cb-d08f-4662-9b64-d809417a2b9f
📒 Files selected for processing (1)
Dockerfile
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
openshift-hyperfleet/architecture(manual)openshift-hyperfleet/hyperfleet-api(manual)openshift-hyperfleet/hyperfleet-sentinel(manual) → reviewed against open PR#231konflux/mintmaker/main/docker-image-updatesinstead of the default branchopenshift-hyperfleet/hyperfleet-adapter(manual) → reviewed against open PR#257konflux/mintmaker/main/docker-image-updatesinstead of the default branchopenshift-hyperfleet/hyperfleet-broker(manual)
| ARG BASE_IMAGE=registry.access.redhat.com/ubi9-micro:latest | ||
|
|
||
| FROM registry.access.redhat.com/ubi9/go-toolset:9.8-1783931515 AS builder | ||
| FROM registry.access.redhat.com/ubi9/go-toolset:9.8-1784190466 AS builder |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
skopeo inspect docker://registry.access.redhat.com/ubi9/go-toolset:9.8-1784190466 \
| jq -r '.Digest'Repository: openshift-hyperfleet/hyperfleet-api
Length of output: 213
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '--- Dockerfile ---\n'
cat -n Dockerfile
printf '\n--- refs to go-toolset ---\n'
rg -n 'ubi9/go-toolset|FROM ' DockerfileRepository: openshift-hyperfleet/hyperfleet-api
Length of output: 264
🏁 Script executed (no clone):
#!/bin/bash
set -euo pipefail
image='registry.access.redhat.com/ubi9/go-toolset:9.8-1784190466'
printf 'Attempting registry v2 HEAD...\n'
curl -fsSI -H 'Accept: application/vnd.docker.distribution.manifest.v2+json' \
"https://${image%%:*}/v2/${image#*/v2/}" >/tmp/registry_head.out 2>/tmp/registry_head.err || true
printf '\nHEAD stdout/stderr summary:\n'
sed -n '1,40p' /tmp/registry_head.out 2>/dev/null || true
sed -n '1,80p' /tmp/registry_head.err 2>/dev/null || true
Length of output: 429
🏁 Script executed:
#!/bin/bash
set -euo pipefail
sed -n '1,40p' Dockerfile | cat -nRepository: openshift-hyperfleet/hyperfleet-api
Length of output: 1759
Pin the base images by digest (CWE-494). ubi9/go-toolset:9.8-1784190466 and ubi9-micro:latest are mutable tags; a registry retag can silently change the build toolchain or runtime image.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@Dockerfile` at line 3, Pin the Dockerfile base images used by the builder
stage and runtime stage to immutable digests instead of mutable tags, including
replacing ubi9/go-toolset:9.8-1784190466 and ubi9-micro:latest with their
corresponding sha256 digests while preserving the existing stage structure.
Source: Path instructions
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: rafabene The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
1 participant
This PR contains the following updates:
9.8-1783931515→9.8-1784190466Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
To execute skipped test pipelines write comment
/ok-to-test.Documentation
Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.